Docker · tool · fg-0264
Image built with buildx runs locally but AWS Lambda rejects it because the push is an image index
Lambda create-function or update-function-code rejects an image that pulls and runs fine with docker run
Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100
Cause
Since Buildx 0.10 a provenance attestation is attached by default, which turns even a single-platform push into an image index with an attestation manifest. Lambda only accepts single-architecture images, and Cloud Run had the same limit when the issue was filed.
Fix
Turn off default attestations for images that go to runtimes needing one plain manifest, and build for exactly one platform.
Apply
docker buildx build --platform linux/amd64 --provenance=false --sbom=false -t "$IMAGE" --push . # docker/build-push-action: provenance: false
Affects: Docker Buildx 0.10 and later (January 2023) and docker/build-push-action 3.3.0 and later; AWS Lambda container images as of October 2026
Sources
- https://github.com/docker/buildx/issues/1533
- https://docs.docker.com/build/metadata/attestations/
- https://docs.aws.amazon.com/lambda/latest/dg/images-create.html
Have your agent know this before it fails
claude mcp add --transport http footgun https://getfootgun.com/api/mcp